dangerboot
50 lines
1.4 KiB
Bash
Executable File
50 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
||
set -euo pipefail
|
||
|
||
ARCH=amd64
|
||
BASE_URL=https://cdimage.debian.org/debian-cd/current/$ARCH/iso-cd
|
||
|
||
# Détection du dernier netinst ISO
|
||
ISO=$(wget -qO- "$BASE_URL/" | grep -oP "debian-[0-9.]+-${ARCH}-netinst\.iso" | sort -V | tail -n1)
|
||
SUMS=SHA256SUMS
|
||
SIG=SHA256SUMS.sign
|
||
|
||
echo "Latest ISO found: $ISO"
|
||
|
||
# Téléchargement ISO seulement si absent
|
||
if [ ! -f "$ISO" ]; then
|
||
wget -N "$BASE_URL/$ISO"
|
||
else
|
||
echo "$ISO already exists, skipping download."
|
||
fi
|
||
|
||
# Téléchargement des fichiers de contrôle
|
||
wget -N "$BASE_URL/$SUMS"
|
||
wget -N "$BASE_URL/$SIG"
|
||
|
||
# Import des clés Debian Archive (utile pour cohérence générale)
|
||
KEYRING_PKG=debian-archive-keyring_2025.1_all.deb
|
||
if [ ! -f "$KEYRING_PKG" ]; then
|
||
wget "https://ftp.debian.org/debian/pool/main/d/debian-archive-keyring/$KEYRING_PKG"
|
||
fi
|
||
TMPDIR=$(mktemp -d)
|
||
ar x "$KEYRING_PKG" --output="$TMPDIR"
|
||
tar -xf "$TMPDIR"/data.tar.* -C "$TMPDIR"
|
||
gpg --import "$TMPDIR/usr/share/keyrings/debian-archive-keyring.gpg" || true
|
||
rm -rf "$TMPDIR"
|
||
|
||
# Import des clés Debian CD signing (officielles sur debian.org/CD/verify)
|
||
gpg --keyserver hkps://keyring.debian.org --recv-keys \
|
||
DF9B9C49EAA9298432589D76DA87E80D6294BE9B \
|
||
64E6EA7D \
|
||
E0B11894F66AEC98 || true
|
||
|
||
# Vérification signature
|
||
echo "Verifying signature..."
|
||
gpg --verify "$SIG" "$SUMS"
|
||
|
||
# Vérification ciblée uniquement sur l’ISO téléchargé
|
||
echo "Verifying checksum for $ISO..."
|
||
grep "$ISO" "$SUMS" | sha256sum -c -
|
||
|